CLOUD-9← Back to dashboard
COMMITMENT ADVISOR

Connecting your AWS account

The Commitment Advisor can pull your real EC2 usage directly from AWS Cost Explorer so the Shaved Ice algorithm runs on your actual production data — not example numbers. This takes about 5 minutes to set up.

HOW IT WORKS

When you click Connect in the Commitment Advisor, the Cloud-9 API calls ce:GetCostAndUsage on the AWS account whose credentials are configured. It retrieves your daily EC2 instance-hour totals for the last 30 days and sends them to the optimizer. No data is stored — it's used in-memory for that session only.

1

Enable IAM access to billing (root account — one time)

AWS blocks billing data from IAM users by default. A root account holder must enable it once.

  1. Sign in to the AWS console with your root account (not an IAM user)
  2. Click your account name (top right) → Account
  3. Scroll to IAM user and role access to billing information
  4. Click Edit → check Activate IAM Access → Save
⚠ You must be signed in as root to do this step. IAM users — even admins — cannot change this setting.
2

Enable AWS Cost Explorer

Cost Explorer must be turned on before any API calls work (free to enable, charges ~$0.01 per API request).

  1. In the AWS console, search for Cost Explorer
  2. Click Launch Cost Explorer (or Enable Cost Explorer if it hasn't been turned on)
  3. Wait a few minutes — it takes ~24 hours to populate historical data the first time, but the API becomes available immediately
Cost Explorer is per-account. If you have an AWS Organization, enable it in the management (payer) account to see consolidated usage.
3

Create an IAM policy with Cost Explorer read access

Create a minimal policy that grants only what's needed.

  1. Go to IAM → Policies → Create policy
  2. Switch to the JSON editor and paste:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ce:GetCostAndUsage",
        "ce:GetCostForecast"
      ],
      "Resource": "*"
    }
  ]
}
  1. Name it Cloud9CostExplorerReadOnly and save
4

Attach the policy to your IAM user

  1. Go to IAM → Users → click your user
  2. Permissions → Add permissions → Attach policies directly
  3. Search for Cloud9CostExplorerReadOnly → check it → Next → Add permissions
Use an IAM user in your own AWS account — the account where your EC2 instances run. If you don't have one, create a new IAM user in IAM → Users → Create user with programmatic access, then attach this policy to it. Cloud-9 never stores your access keys — they are sent once to fetch your usage data and discarded.
5

Click Connect in the Commitment Advisor

Go back to the Commitment Advisor tab and click Connect.

You should see one of:

  • ✓ Connected — X days loaded — real usage data fetched successfully. The optimizer will use your actual EC2 instance-hours.
  • ⚠ Connected — no EC2 usage found — credentials work, but no EC2 instance-hours were billed in the last 30 days. Use manual entry or example data instead.

TROUBLESHOOTING

"AuthFailure" or "AccessDenied"
Check that the IAM user has the Cloud9CostExplorerReadOnly policy attached AND that IAM billing access is enabled (Step 1).
"Cost Explorer not enabled"
Complete Step 2 — go to the Cost Explorer console and click Launch. It can take a few minutes to activate.
All zeros even with real EC2 usage
Make sure you're checking the right AWS account. The IAM user you connected must belong to the AWS account where your EC2 instances are running.
Zeros for a brand-new account
Cost Explorer only shows usage that has already been billed. Newly launched instances appear within 24 hours.